@junejuly-lockstep/reconciler 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 JuneJuly Health
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,182 @@
+# @junejuly-lockstep/reconciler
+
+The CI side of Lockstep. `lockstep reconcile` runs inside the client repo's GitHub Actions, never on
+platform infrastructure, and never against a real backend. It extracts the navigation graph from
+source, snapshots the GraphQL contract, walks every declared journey in Chromium against seeded
+mocks, diffs screenshots against approved baselines, uploads the evidence, and posts one
+`RunPayload` to the platform. The platform computes verdicts; this package only reports facts.
+
+`lockstep sync-models` is the lightweight sibling that runs on every push to the default branch
+and mirrors the parsed journey models to the platform (see "Model sync" below).
+
+## Install
+
+```bash
+pnpm add -D @junejuly-lockstep/reconciler playwright
+pnpm exec playwright install --with-deps chromium
+npx lockstep init        # writes the example config, journey, scenarios, MSW handlers, workflow
+npx lockstep validate    # checks the contract below, no walk
+```
+
+Node 20.18 or newer. `xstate` v5 and `msw` v2 are expected in the client app (the example journey
+and handlers import them).
+
+## Contract checklist
+
+The reconciler fails fast with exit code 1 and a named violation when any item is missing.
+`lockstep validate` prints the same list with a pass/fail per item.
+
+| Item                                                 | What the reconciler checks                                                                                                                                                                                              | Violation name                                     |
+| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
+| `lockstep.config.ts` at the repo root                | parses with the `LockstepConfig` schema: `projectKey`, `apiBaseUrl`, `journeysGlob`, `scenariosPath`, `seams` (6 to 8), `visualDiffThreshold`, `bootCommand`, `port`, optional `appApiBase`, `mockApiPattern`, `schema` | `lockstep.config.ts`, `lockstep.config.ts:<field>` |
+| One `*.journey.ts` per journey matching the glob     | exports `machine` (XState v5 `createMachine` or plain config) and `meta` (narrative, per-state `route`/`testId`/`intent`/`rules`, `bindings`); every state has meta, every target resolves                              | `journeys`, `journey:<file>`                       |
+| Scenarios file                                       | exports an array of `{ name, seed, overrides }` (or a record keyed by name); names unique                                                                                                                               | `scenarios`                                        |
+| Seeded MSW handlers                                  | not inspected statically; the walk refuses to run unless `appApiBase` matches `mockApiPattern`                                                                                                                          | `appApiBase`, `mockApiPattern`                     |
+| `data-testid` on every state root and trigger        | asserted during the walk; a missing id fails the step                                                                                                                                                                   | (walk result, not a violation)                     |
+| `.github/workflows/lockstep-reconcile.yml` committed | file exists                                                                                                                                                                                                             | `workflow`                                         |
+| `LOCKSTEP_API_KEY` secret                            | env var set, `lsk_` prefix                                                                                                                                                                                              | `apiKey`                                           |
+| Lockstep GitHub App installed                        | not checked here; the platform's webhook needs it                                                                                                                                                                       |                                                    |
+
+Journey keys come from the file name (`book-a-visit.journey.ts` -> `book-a-visit`); export `key`
+and `name` to override. Guards and actions in the machine are kept as string names; their
+implementations stay in the app.
+
+## CLI
+
+```
+lockstep reconcile [options]
+  --ref <sha>                  commit under test (default GITHUB_SHA, then git HEAD)
+  --kind deploy|pr             default deploy
+  --pr <n>                     PR number (required for --kind pr unless GITHUB_REF is refs/pull/<n>/...)
+  --env staging|prod|preview   default staging
+  --deploy-label <label>       e.g. d14
+  --config <path>              default lockstep.config.ts
+  --out <dir>                  default .lockstep (gitignored local output)
+  --dry-run                    full local pipeline, no API calls, no upload, no post
+  --fail-on-verdicts auto|always|never
+                               auto = report-only for pr, fail for deploy
+  --determinism-check          walk twice; exit 2 if any screenshot differs
+  --declared-seams <a,b>       seams the author declares a backend change touches
+  --base <ref>                 git ref whose SDL the change list diffs against (default HEAD~1)
+  --api-base-url <url>         post to this platform origin instead of apiBaseUrl in the config
+                               (also LOCKSTEP_API_BASE_URL); for local rehearsals, never set in CI
+
+lockstep sync-models [options]
+  --ref <sha>                  commit being synced (default GITHUB_SHA, then git HEAD)
+  --branch <name>              branch pushed to (default GITHUB_REF_NAME, then the checked-out branch)
+  --pushed-at <iso>            commit time (default: committer date from git, then now)
+  --config <path>              default lockstep.config.ts
+  --out <dir>                  default .lockstep
+  --dry-run                    load, validate and write the payload; no API call
+
+lockstep validate [--config <path>] [--offline]
+lockstep init [--force] [--dir <path>]
+```
+
+### Model sync (`lockstep sync-models`)
+
+The platform never executes client code, and journey files are TypeScript, so the API cannot read
+a model change out of a GitHub webhook. Instead the shipped workflow runs `lockstep sync-models` on
+every push to the default branch: it loads `lockstep.config.ts`, the journey files and the scenarios
+with the same loaders `reconcile` uses (same ordering, same `validateJourney` checks), builds a
+`ModelSyncPayload` and posts it to `POST /api/ingest/models`. The platform upserts the journeys,
+stores one model version per journey for the commit (idempotent), stores the scenarios, archives
+journeys the default branch no longer declares, and the canvas picks the change up on its next
+10 second poll. The GitHub `push` webhook only marks the commit as "model sync pending" until the
+payload arrives, which is what the pending chip in the canvas header shows.
+
+Exit codes: 0 synced, 1 contract violation (including a 422 from the platform, which lists the
+rejected journeys), 2 infrastructure (network, platform down). Local output:
+`.lockstep/model-sync-payload.json` and `.lockstep/model-sync-response.json`.
+
+Pipeline order inside `reconcile`:
+
+1. Load and validate the config, verify the contract, refuse non-mock `appApiBase`.
+2. Load journeys (jiti, TypeScript at runtime) and scenarios.
+3. Extract with ts-morph: route manifest (app router and pages router), every `<Link href>`,
+   `router.push`, `router.replace`, `redirect()` with enclosing handler, trigger element text and
+   `data-testid`, lifted guard predicate; dynamic targets are `unresolved`.
+4. Contract snapshot: sha256 of the lexicographically sorted, re-printed SDL; per-operation response
+   shape hashes from the graphql-codegen output; lockfile hash. A human-readable change list against
+   `--base` is written to `.lockstep/contract-changes.md`.
+5. Fetch the baseline manifest (`GET /api/ingest/baselines?project=KEY`) and download baselines.
+6. Walk: boot the app once per scenario with `LOCKSTEP_SCENARIO` and `LOCKSTEP_SEED`, enumerate one
+   shortest path per state with `@xstate/graph`, execute each path in Chromium, full-page PNG per
+   step, GraphQL operation log per step, Playwright trace per path. One retry per step; a second
+   failure records `fail` and skips the rest of that path. The boot only counts once the port has
+   stayed open for 750 ms with the process alive (`next start` listens before it checks for a
+   build), and an app that dies mid-walk is an infrastructure failure (exit 2), never a row of
+   failed transitions.
+7. Visual diff with pixelmatch (per-pixel threshold 0.1); score = differing pixels / total pixels;
+   size mismatch scores 1.
+8. Upload PNGs, diffs and traces with presigned PUTs in batches of 50 under `runs/{runId}/`.
+9. Assemble and validate the `RunPayload`, post it to `POST /api/ingest/runs`, print a summary.
+
+Local output in `.lockstep/`: `extracted-graph.json`, `contract-snapshot.json`,
+`schema.canonical.graphql`, `contract-changes.md`, `walk.json`, `run-payload.json`,
+`ingest-response.json`, `determinism.txt`, and `artifacts/` mirroring the uploaded keys. Every one
+of these describes the current run only: stale copies from a previous run are deleted first.
+
+To run the whole pipeline against a local platform with no AWS, see
+[docs/M4-acceptance.md](../../docs/M4-acceptance.md) (`scripts/m4-rehearsal.ps1` / `.sh`).
+
+## Exit codes
+
+| Code | Meaning                                                                        | Workflow behaviour                                           |
+| ---- | ------------------------------------------------------------------------------ | ------------------------------------------------------------ |
+| 0    | Run posted, nothing needs judgment                                             | green                                                        |
+| 1    | Contract violation; nothing walked or posted                                   | red, fix the repo                                            |
+| 2    | Infrastructure failure: boot, browser, upload, platform API, determinism check | red, retry or investigate                                    |
+| 3    | Run posted and verdicts need judgment                                          | `auto`: PR runs return 0 (report-only), deploy runs return 3 |
+
+The shipped workflow passes `--fail-on-verdicts never` on `pull_request` and `always` on
+`deployment_status`, so a red deploy is visible in GitHub as well as on the board. Its
+`sync-models` job runs on `push` to the default branch only (no browser, no app build). It also
+accepts `workflow_dispatch` (Actions -> Lockstep reconcile -> Run workflow) with inputs `kind`
+(deploy|pr), `env` (staging|prod|preview), `deploy_label` and `pr`, running the checked-out commit
+with `--fail-on-verdicts auto`: the manual deploy-run path for repos whose hosting never emits
+`deployment_status`, and a way to re-run a deploy run by hand.
+
+## Determinism rules
+
+Same commit plus same seed must produce byte-identical screenshots. These are enforced by the
+walker (`src/walk.ts`) and listed by `lockstep validate`:
+
+| Rule                           | How                                                                                                                                                                                                                                   |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Frozen clock                   | `page.clock.install({ time: FROZEN_EPOCH_MS })` then `setFixedTime`; `Date.now()` is 2026-01-15T09:30:00Z on every page                                                                                                               |
+| Fixed viewport                 | 1280x800, `deviceScaleFactor: 1`, desktop, no touch                                                                                                                                                                                   |
+| No motion                      | `reducedMotion: 'reduce'`; CSS injected before first paint disables animations, transitions, caret and smooth scroll; screenshots use `animations: 'disabled'`                                                                        |
+| Fonts awaited                  | `document.fonts.ready` plus two animation frames before each shot; Chromium runs with font hinting and subpixel positioning off, sRGB colour profile                                                                                  |
+| Full tile raster               | `--disable-partial-raster`: a tile whose content changed after first paint is rastered whole, never only inside the damage rect (whose edges differ by a unit of anti-aliasing from walk to walk)                                     |
+| Settled after the root appears | once the state root is visible the walker settles again (network idle, fonts, four frames), since an app that fetches through a mock worker renders its root after the first settle; the pointer is parked at (0,0) after every click |
+| Fixed locale and zone          | `locale: 'en-US'`, `timezoneId: 'UTC'`, `TZ=UTC` in the app process, light colour scheme                                                                                                                                              |
+| Seeded mocks only              | `LOCKSTEP_SCENARIO`/`LOCKSTEP_SEED` in the app environment and `?lockstep_scenario=&lockstep_seed=` on the first navigation; `appApiBase` must match `mockApiPattern`                                                                 |
+| Deterministic ordering         | scenarios by name, journeys by key, paths by target state then event sequence, files by path                                                                                                                                          |
+| Fresh context per path         | new browser context for every path: no storage, cookies or cache carry over                                                                                                                                                           |
+| CSS-pixel full-page shots      | `fullPage: true`, `scale: 'css'`, caret hidden, scrollbars hidden                                                                                                                                                                     |
+
+What the client app must do in return: derive every mock value from the scenario seed (see
+`templates/msw-handlers.example.ts`, which uses a tiny mulberry32 PRNG and no faker), never read
+`Date.now()` outside the page (server components run outside the frozen clock), give images fixed
+dimensions, and avoid rendering random ids into the DOM. Run `lockstep reconcile --dry-run
+--determinism-check` locally to prove it before the first deploy.
+
+## Programmatic use
+
+Every stage is exported and independently testable:
+
+```ts
+import {
+  loadAndCheck,
+  loadJourneys,
+  extractGraph,
+  snapshotContract,
+  walk,
+  compareWalk,
+  assembleRunPayload,
+} from '@junejuly-lockstep/reconciler';
+```
+
+`walk()` accepts `deps: { launch, boot }` so it can run against a fake browser in unit tests; the
+real Playwright import is lazy and only happens when a walk actually runs.

package/dist/boot.d.ts

@@ -0,0 +1,51 @@
+import { type ChildProcess } from 'node:child_process';
+export interface BootOptions {
+    command: string;
+    port: number;
+    cwd: string;
+    env?: Record<string, string>;
+    /** How long to wait for the port to accept connections. Default 120s. */
+    timeoutMs?: number;
+    /** How long the port must stay open with the process alive. Default BOOT_SETTLE_MS. */
+    settleMs?: number;
+    host?: string;
+    log?: (line: string) => void;
+}
+export interface BootedApp {
+    pid: number | null;
+    /** Kill the whole process tree; resolves once the process has exited. */
+    stop(): Promise<void>;
+    /** Last lines of stdout/stderr, for diagnostics. */
+    output(): string[];
+    /** False once the app process has exited (or failed to spawn). */
+    alive(): boolean;
+}
+/**
+ * How long the port must stay open, with the process still alive, before the boot counts.
+ * `next start` (and other servers) open the listener before loading the build, so a port that
+ * answers once is not proof of an app that will answer the walk.
+ */
+export declare const BOOT_SETTLE_MS = 750;
+/** How long a port left behind by the previous app process may take to close before boot refuses it. */
+export declare const PORT_RELEASE_GRACE_MS = 5000;
+export declare function isPortOpen(port: number, host?: string, timeoutMs?: number): Promise<boolean>;
+export declare function waitForPort(port: number, opts?: {
+    host?: string;
+    timeoutMs?: number;
+    intervalMs?: number;
+    isAlive?: () => boolean;
+}): Promise<void>;
+/** Resolve once nothing accepts connections on the port any more (or the deadline passes). */
+export declare function waitForPortClosed(port: number, opts?: {
+    host?: string;
+    timeoutMs?: number;
+    intervalMs?: number;
+}): Promise<boolean>;
+/** Kill a process and all of its children. */
+export declare function killTree(child: ChildProcess): Promise<void>;
+/**
+ * Boot the app under test with `bootCommand` and wait for `port`. The port must be free
+ * beforehand: a stray server would walk with the wrong scenario seed.
+ */
+export declare function bootApp(opts: BootOptions): Promise<BootedApp>;
+//# sourceMappingURL=boot.d.ts.map

package/dist/boot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot.d.ts","sourceRoot":"","sources":["../src/boot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAK9D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,yEAAyE;IACzE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,oDAAoD;IACpD,MAAM,IAAI,MAAM,EAAE,CAAC;IACnB,kEAAkE;IAClE,KAAK,IAAI,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAClC,wGAAwG;AACxG,eAAO,MAAM,qBAAqB,OAAQ,CAAC;AAE3C,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAc,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAa/F;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAA;CAAO,GAC7F,OAAO,CAAC,IAAI,CAAC,CASf;AAED,8FAA8F;AAC9F,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GACpE,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,8CAA8C;AAC9C,wBAAsB,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BjE;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CA0EnE"}

package/dist/boot.js

@@ -0,0 +1,162 @@
+import { spawn } from 'node:child_process';
+import net from 'node:net';
+import { InfrastructureError } from './errors.js';
+import { sleep } from './util.js';
+/**
+ * How long the port must stay open, with the process still alive, before the boot counts.
+ * `next start` (and other servers) open the listener before loading the build, so a port that
+ * answers once is not proof of an app that will answer the walk.
+ */
+export const BOOT_SETTLE_MS = 750;
+/** How long a port left behind by the previous app process may take to close before boot refuses it. */
+export const PORT_RELEASE_GRACE_MS = 5_000;
+export function isPortOpen(port, host = '127.0.0.1', timeoutMs = 1000) {
+    return new Promise((resolve) => {
+        const socket = new net.Socket();
+        const done = (ok) => {
+            socket.destroy();
+            resolve(ok);
+        };
+        socket.setTimeout(timeoutMs);
+        socket.once('connect', () => done(true));
+        socket.once('timeout', () => done(false));
+        socket.once('error', () => done(false));
+        socket.connect(port, host);
+    });
+}
+export async function waitForPort(port, opts = {}) {
+    const deadline = Date.now() + (opts.timeoutMs ?? 120_000);
+    while (Date.now() < deadline) {
+        if (opts.isAlive && !opts.isAlive())
+            throw new InfrastructureError(`app process exited before port ${port} opened`);
+        if (await isPortOpen(port, opts.host))
+            return;
+        await sleep(opts.intervalMs ?? 500);
+    }
+    throw new InfrastructureError(`timed out waiting for port ${port} to open`);
+}
+/** Resolve once nothing accepts connections on the port any more (or the deadline passes). */
+export async function waitForPortClosed(port, opts = {}) {
+    const deadline = Date.now() + (opts.timeoutMs ?? 10_000);
+    while (Date.now() < deadline) {
+        if (!(await isPortOpen(port, opts.host)))
+            return true;
+        await sleep(opts.intervalMs ?? 200);
+    }
+    return !(await isPortOpen(port, opts.host));
+}
+/** Kill a process and all of its children. */
+export async function killTree(child) {
+    if (child.exitCode !== null || child.pid === undefined)
+        return;
+    const exited = new Promise((resolve) => child.once('exit', () => resolve()));
+    if (process.platform === 'win32') {
+        await new Promise((resolve) => {
+            const killer = spawn('taskkill', ['/pid', String(child.pid), '/T', '/F'], {
+                stdio: 'ignore',
+            });
+            killer.once('exit', () => resolve());
+            killer.once('error', () => resolve());
+        });
+    }
+    else {
+        try {
+            process.kill(-child.pid, 'SIGTERM');
+        }
+        catch {
+            try {
+                child.kill('SIGTERM');
+            }
+            catch {
+                /* already gone */
+            }
+        }
+        const grace = sleep(5000).then(() => {
+            try {
+                process.kill(-child.pid, 'SIGKILL');
+            }
+            catch {
+                /* already gone */
+            }
+        });
+        await Promise.race([exited, grace]);
+    }
+    await Promise.race([exited, sleep(10_000)]);
+}
+/**
+ * Boot the app under test with `bootCommand` and wait for `port`. The port must be free
+ * beforehand: a stray server would walk with the wrong scenario seed.
+ */
+export async function bootApp(opts) {
+    const host = opts.host ?? '127.0.0.1';
+    const log = opts.log ?? (() => { });
+    // A previous scenario's server may still be releasing the port (its process tree was killed a
+    // moment ago); give it a few seconds. A server that is really running is still refused.
+    if (!(await waitForPortClosed(opts.port, { host, timeoutMs: PORT_RELEASE_GRACE_MS }))) {
+        throw new InfrastructureError(`port ${opts.port} is already in use; stop the other server so the walk boots the app with the scenario seed`);
+    }
+    const lines = [];
+    const push = (chunk) => {
+        for (const line of chunk.toString('utf8').split(/\r?\n/)) {
+            if (!line.trim())
+                continue;
+            lines.push(line);
+            if (lines.length > 200)
+                lines.shift();
+            log(`[app] ${line}`);
+        }
+    };
+    const child = spawn(opts.command, {
+        cwd: opts.cwd,
+        shell: true,
+        detached: process.platform !== 'win32',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: {
+            ...process.env,
+            PORT: String(opts.port),
+            HOSTNAME: host,
+            ...opts.env,
+        },
+    });
+    child.stdout?.on('data', push);
+    child.stderr?.on('data', push);
+    let exited = false;
+    child.once('exit', () => {
+        exited = true;
+    });
+    child.once('error', (err) => {
+        lines.push(`spawn error: ${err.message}`);
+        exited = true;
+    });
+    const failBoot = async (message) => {
+        await killTree(child);
+        const tail = lines.slice(-20).join('\n');
+        throw new InfrastructureError(`${message}\ncommand: ${opts.command}${tail ? `\nlast output:\n${tail}` : ''}`);
+    };
+    try {
+        await waitForPort(opts.port, { host, timeoutMs: opts.timeoutMs, isAlive: () => !exited });
+    }
+    catch (err) {
+        return failBoot(err instanceof Error ? err.message : String(err));
+    }
+    // The port opened; make sure the process survives it and the port stays open. A server that
+    // listens and then dies (no production build, a crash on first import) must be an
+    // infrastructure failure here, never a run full of failed steps.
+    await sleep(opts.settleMs ?? BOOT_SETTLE_MS);
+    if (exited)
+        return failBoot(`app process exited right after port ${opts.port} opened`);
+    if (!(await isPortOpen(opts.port, host)))
+        return failBoot(`port ${opts.port} closed again right after it opened`);
+    return {
+        pid: child.pid ?? null,
+        // The top-level process (a shell or pnpm) exits before its grandchild releases the socket;
+        // the next scenario's boot must find the port closed, so wait for that here.
+        stop: async () => {
+            await killTree(child);
+            await waitForPortClosed(opts.port, { host });
+        },
+        output: () => [...lines],
+        alive: () => !exited,
+    };
+}
+//# sourceMappingURL=boot.js.map

package/dist/boot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot.js","sourceRoot":"","sources":["../src/boot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAyBlC;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,wGAAwG;AACxG,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAI,GAAG,WAAW,EAAE,SAAS,GAAG,IAAI;IAC3E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,CAAC,EAAW,EAAE,EAAE;YAC3B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,EAAE,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,OAA4F,EAAE;IAE9F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YACjC,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,IAAI,SAAS,CAAC,CAAC;QACjF,IAAI,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9C,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,IAAI,UAAU,CAAC,CAAC;AAC9E,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,OAAmE,EAAE;IAErE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAmB;IAChD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO;IAC/D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;gBACxE,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAI,EAAE,SAAS,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAiB;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,8FAA8F;IAC9F,wFAAwF;IACxF,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,mBAAmB,CAC3B,QAAQ,IAAI,CAAC,IAAI,4FAA4F,CAC9G,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACtC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;QAChC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;QACtC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YACvB,QAAQ,EAAE,IAAI;YACd,GAAG,IAAI,CAAC,GAAG;SACZ;KACF,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC1B,KAAK,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1C,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAe,EAAkB,EAAE;QACzD,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,mBAAmB,CAC3B,GAAG,OAAO,cAAc,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/E,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,4FAA4F;IAC5F,kFAAkF;IAClF,iEAAiE;IACjE,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,OAAO,QAAQ,CAAC,uCAAuC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,QAAQ,CAAC,QAAQ,IAAI,CAAC,IAAI,qCAAqC,CAAC,CAAC;IAE1E,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI;QACtB,2FAA2F;QAC3F,6EAA6E;QAC7E,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;QACxB,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM;KACrB,CAAC;AACJ,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+export declare function buildProgram(): Command;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAwB,MAAM,WAAW,CAAC;AA6B1D,wBAAgB,YAAY,IAAI,OAAO,CA0KtC"}

package/dist/cli.js

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+import { Command, InvalidArgumentError } from 'commander';
+import { Env, RunKind } from '@junejuly-lockstep/model';
+import { ContractViolation } from './errors.js';
+import { EXIT, FAIL_ON_VERDICTS_MODES, exitCodeForError, parseFailOnVerdicts, shouldFailOnVerdicts, } from './exitCodes.js';
+import { INIT_FILES, init } from './init.js';
+import { reconcile, validate } from './reconcile.js';
+import { syncModels } from './sync.js';
+import { DETERMINISM_RULES } from './determinism.js';
+import { reconcilerVersion } from './util.js';
+function enumParser(values, label) {
+    return (value) => {
+        if (values.includes(value))
+            return value;
+        throw new InvalidArgumentError(`${label} must be one of ${values.join('|')}`);
+    };
+}
+function intParser(value) {
+    const n = Number.parseInt(value, 10);
+    if (!Number.isInteger(n) || n <= 0)
+        throw new InvalidArgumentError('must be a positive integer');
+    return n;
+}
+export function buildProgram() {
+    const program = new Command();
+    program
+        .name('lockstep')
+        .description('Lockstep reconciler: extract, snapshot, walk, diff and post a run to the platform; sync journey models on push.')
+        .version(reconcilerVersion());
+    program
+        .command('reconcile')
+        .description('Run the full pipeline and post the run (exit 0 clean, 1 contract, 2 infrastructure, 3 verdicts)')
+        .option('--ref <sha>', 'commit SHA under test (default: GITHUB_SHA or git HEAD)')
+        .option('--kind <kind>', 'deploy|pr', enumParser(RunKind.options, '--kind'), 'deploy')
+        .option('--pr <n>', 'pull request number (required for --kind pr unless GITHUB_REF is a PR ref)', intParser)
+        .option('--env <env>', 'staging|prod|preview', enumParser(Env.options, '--env'), 'staging')
+        .option('--deploy-label <label>', 'deploy label, e.g. d14')
+        .option('--config <path>', 'path to lockstep.config.ts', 'lockstep.config.ts')
+        .option('--out <dir>', 'local output directory', '.lockstep')
+        .option('--dry-run', 'run everything locally; no API calls, no upload, no post', false)
+        .option('--fail-on-verdicts <mode>', `${FAIL_ON_VERDICTS_MODES.join('|')} (auto: report-only for pr, fail for deploy)`, 'auto')
+        .option('--determinism-check', 'walk twice and fail (exit 2) when any screenshot differs', false)
+        .option('--declared-seams <list>', 'comma-separated seams the author declares this change touches')
+        .option('--base <ref>', 'git ref to diff the GraphQL SDL against', 'HEAD~1')
+        .option('--api-base-url <url>', 'platform API origin to use instead of apiBaseUrl in the config (or LOCKSTEP_API_BASE_URL); for local rehearsals')
+        .action(async (o) => {
+        try {
+            const result = await reconcile({
+                ref: o['ref'],
+                kind: o['kind'],
+                pr: o['pr'],
+                env: o['env'],
+                deployLabel: o['deployLabel'],
+                configPath: o['config'],
+                outDir: o['out'],
+                apiBaseUrl: o['apiBaseUrl'],
+                dryRun: Boolean(o['dryRun']),
+                failOnVerdicts: parseFailOnVerdicts(o['failOnVerdicts']),
+                determinismCheck: Boolean(o['determinismCheck']),
+                declaredSeams: typeof o['declaredSeams'] === 'string'
+                    ? o['declaredSeams']
+                        .split(',')
+                        .map((s) => s.trim())
+                        .filter(Boolean)
+                    : [],
+                baseRef: o['base'],
+            });
+            if (result.response && result.response.judgmentCount > 0) {
+                const fails = shouldFailOnVerdicts(o['kind'], parseFailOnVerdicts(o['failOnVerdicts']));
+                console.log(`${result.response.judgmentCount} verdict(s) need judgment${fails ? '' : ' (report-only; not failing the job)'}.`);
+            }
+            process.exitCode = result.exitCode;
+        }
+        catch (err) {
+            reportError(err);
+            process.exitCode = exitCodeForError(err);
+        }
+    });
+    program
+        .command('validate')
+        .description('Check the client contract only (config, journeys, scenarios, workflow, API key); no walk')
+        .option('--config <path>', 'path to lockstep.config.ts', 'lockstep.config.ts')
+        .option('--offline', 'do not require LOCKSTEP_API_KEY', false)
+        .action(async (o) => {
+        try {
+            const result = await validate({
+                configPath: o['config'],
+                offline: Boolean(o['offline']),
+            });
+            console.log('Lockstep contract check');
+            for (const line of result.lines)
+                console.log(line);
+            console.log('');
+            console.log('Determinism rules enforced by the walk:');
+            for (const r of DETERMINISM_RULES)
+                console.log(`  - ${r.rule}: ${r.how}`);
+            console.log('');
+            console.log(result.ok ? 'Contract satisfied.' : 'Contract NOT satisfied.');
+            process.exitCode = result.ok ? EXIT.CLEAN : EXIT.CONTRACT_VIOLATION;
+        }
+        catch (err) {
+            reportError(err);
+            process.exitCode = exitCodeForError(err);
+        }
+    });
+    program
+        .command('sync-models')
+        .description('Load the journey files and scenarios and post the parsed models to the platform (M3 model sync; run on push to the default branch). Exit 0 ok, 1 contract, 2 infrastructure')
+        .option('--ref <sha>', 'commit SHA being synced (default: GITHUB_SHA or git HEAD)')
+        .option('--branch <name>', 'branch the commit was pushed to (default: GITHUB_REF_NAME, then the checked-out branch)')
+        .option('--pushed-at <iso>', 'commit time, ISO 8601 (default: the commit’s committer date from git, then now)')
+        .option('--config <path>', 'path to lockstep.config.ts', 'lockstep.config.ts')
+        .option('--out <dir>', 'local output directory', '.lockstep')
+        .option('--dry-run', 'load, validate and write the payload locally; no API call', false)
+        .action(async (o) => {
+        try {
+            const result = await syncModels({
+                ref: o['ref'],
+                branch: o['branch'],
+                pushedAt: o['pushedAt'],
+                configPath: o['config'],
+                outDir: o['out'],
+                dryRun: Boolean(o['dryRun']),
+            });
+            process.exitCode = result.exitCode;
+        }
+        catch (err) {
+            reportError(err);
+            process.exitCode = exitCodeForError(err);
+        }
+    });
+    program
+        .command('init')
+        .description('Write the example config, journey, scenarios, MSW handlers and the CI workflow')
+        .option('--force', 'overwrite existing files', false)
+        .option('--dir <path>', 'target directory', process.cwd())
+        .action((o) => {
+        try {
+            const result = init(o['dir'], { force: Boolean(o['force']) });
+            for (const f of result.written)
+                console.log(`  wrote    ${f}`);
+            for (const f of result.skipped)
+                console.log(`  kept     ${f} (exists; use --force to overwrite)`);
+            console.log('');
+            console.log('Next steps:');
+            for (const f of INIT_FILES)
+                console.log(`  - ${f.dest}: ${f.purpose}`);
+            console.log('  - add LOCKSTEP_API_KEY to the repo secrets, install the Lockstep GitHub App, run `npx lockstep validate`');
+            process.exitCode = EXIT.CLEAN;
+        }
+        catch (err) {
+            reportError(err);
+            process.exitCode = EXIT.INFRASTRUCTURE;
+        }
+    });
+    return program;
+}
+function reportError(err) {
+    if (err instanceof ContractViolation) {
+        console.error('');
+        console.error(err.message);
+        console.error('');
+        console.error('The repo does not meet the Lockstep client contract. See `lockstep validate` and the README checklist.');
+        return;
+    }
+    console.error('');
+    console.error(err instanceof Error ? `${err.name}: ${err.message}` : String(err));
+    if (err instanceof Error && err.stack && process.env['LOCKSTEP_DEBUG'])
+        console.error(err.stack);
+}
+const invokedDirectly = typeof process.argv[1] === 'string' && /(^|[\\/])(cli\.(js|ts)|lockstep)$/.test(process.argv[1]);
+if (invokedDirectly) {
+    buildProgram()
+        .parseAsync(process.argv)
+        .catch((err) => {
+        reportError(err);
+        process.exitCode = exitCodeForError(err);
+    });
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,IAAI,EACJ,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,SAAS,UAAU,CAAmB,MAAoB,EAAE,KAAa;IACvE,OAAO,CAAC,KAAa,EAAK,EAAE;QAC1B,IAAK,MAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAU,CAAC;QACrE,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,mBAAmB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,CAAC,CAAC;IACjG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO;SACJ,IAAI,CAAC,UAAU,CAAC;SAChB,WAAW,CACV,iHAAiH,CAClH;SACA,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAEhC,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CACV,iGAAiG,CAClG;SACA,MAAM,CAAC,aAAa,EAAE,yDAAyD,CAAC;SAChF,MAAM,CAAC,eAAe,EAAE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC;SACrF,MAAM,CACL,UAAU,EACV,4EAA4E,EAC5E,SAAS,CACV;SACA,MAAM,CAAC,aAAa,EAAE,sBAAsB,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC;SAC1F,MAAM,CAAC,wBAAwB,EAAE,wBAAwB,CAAC;SAC1D,MAAM,CAAC,iBAAiB,EAAE,4BAA4B,EAAE,oBAAoB,CAAC;SAC7E,MAAM,CAAC,aAAa,EAAE,wBAAwB,EAAE,WAAW,CAAC;SAC5D,MAAM,CAAC,WAAW,EAAE,0DAA0D,EAAE,KAAK,CAAC;SACtF,MAAM,CACL,2BAA2B,EAC3B,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,8CAA8C,EACjF,MAAM,CACP;SACA,MAAM,CACL,qBAAqB,EACrB,0DAA0D,EAC1D,KAAK,CACN;SACA,MAAM,CACL,yBAAyB,EACzB,+DAA+D,CAChE;SACA,MAAM,CAAC,cAAc,EAAE,yCAAyC,EAAE,QAAQ,CAAC;SAC3E,MAAM,CACL,sBAAsB,EACtB,iHAAiH,CAClH;SACA,MAAM,CAAC,KAAK,EAAE,CAA0B,EAAE,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;gBAC7B,GAAG,EAAE,CAAC,CAAC,KAAK,CAAuB;gBACnC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAY;gBAC1B,EAAE,EAAE,CAAC,CAAC,IAAI,CAAuB;gBACjC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAQ;gBACpB,WAAW,EAAE,CAAC,CAAC,aAAa,CAAuB;gBACnD,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAW;gBACjC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAW;gBAC1B,UAAU,EAAE,CAAC,CAAC,YAAY,CAAuB;gBACjD,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBAC5B,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,CAAW,CAAC;gBAClE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAChD,aAAa,EACX,OAAO,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ;oBACpC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;yBACf,KAAK,CAAC,GAAG,CAAC;yBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;yBACpB,MAAM,CAAC,OAAO,CAAC;oBACpB,CAAC,CAAC,EAAE;gBACR,OAAO,EAAE,CAAC,CAAC,MAAM,CAAW;aAC7B,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;gBACzD,MAAM,KAAK,GAAG,oBAAoB,CAChC,CAAC,CAAC,MAAM,CAAY,EACpB,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,CAAW,CAAC,CACnD,CAAC;gBACF,OAAO,CAAC,GAAG,CACT,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,4BAA4B,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qCAAqC,GAAG,CAClH,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,CAAC,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CACV,0FAA0F,CAC3F;SACA,MAAM,CAAC,iBAAiB,EAAE,4BAA4B,EAAE,oBAAoB,CAAC;SAC7E,MAAM,CAAC,WAAW,EAAE,iCAAiC,EAAE,KAAK,CAAC;SAC7D,MAAM,CAAC,KAAK,EAAE,CAA0B,EAAE,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;gBAC5B,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAW;gBACjC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aAC/B,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACvD,KAAK,MAAM,CAAC,IAAI,iBAAiB;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;YAC3E,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,CAAC,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CACV,6KAA6K,CAC9K;SACA,MAAM,CAAC,aAAa,EAAE,2DAA2D,CAAC;SAClF,MAAM,CACL,iBAAiB,EACjB,yFAAyF,CAC1F;SACA,MAAM,CACL,mBAAmB,EACnB,iFAAiF,CAClF;SACA,MAAM,CAAC,iBAAiB,EAAE,4BAA4B,EAAE,oBAAoB,CAAC;SAC7E,MAAM,CAAC,aAAa,EAAE,wBAAwB,EAAE,WAAW,CAAC;SAC5D,MAAM,CAAC,WAAW,EAAE,2DAA2D,EAAE,KAAK,CAAC;SACvF,MAAM,CAAC,KAAK,EAAE,CAA0B,EAAE,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;gBAC9B,GAAG,EAAE,CAAC,CAAC,KAAK,CAAuB;gBACnC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAuB;gBACzC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAuB;gBAC7C,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAW;gBACjC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAW;gBAC1B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;aAC7B,CAAC,CAAC;YACH,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,CAAC,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gFAAgF,CAAC;SAC7F,MAAM,CAAC,SAAS,EAAE,0BAA0B,EAAE,KAAK,CAAC;SACpD,MAAM,CAAC,cAAc,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACzD,MAAM,CAAC,CAAC,CAA0B,EAAE,EAAE;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAW,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YACxE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;gBAC5B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,qCAAqC,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,UAAU;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CACT,4GAA4G,CAC7G,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CACX,wGAAwG,CACzG,CAAC;QACF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,eAAe,GACnB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACnG,IAAI,eAAe,EAAE,CAAC;IACpB,YAAY,EAAE;SACX,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;SACxB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACP,CAAC"}